Wednesday, June 17, 2015

Being on the hunt for the cheapest wireless temperature and humidity sensors led me to FreeTec NC-7345-675 - sold by pearl.de at the fair price of 10E, though I might have paid even less for them.
The requirements were: multi-channel, have at least 0.5C accuracy and provide humidity readout. Rolling your own can easily cost more than that.
The sensors pair with this weather station.

The goal is to store all the data on an SBC and provide a nice HTML frontend with long-term statistics and heating automation.

EDIT: blogger removed without warning all the newlines from my code, I had to redo some of those

Hardware

The first step is to open up the sensors and see what we are dealing with.

With the main board detached from the zebra display connector, we can see the coil antenna at the top and the wires for the humidity sensor running at the bottom right.
Judging by the traces going from the SW-CH part directly into the chip it seems there is no way to force additional channels.

On the other side, the top part is the 433Mhz transmitter. Behind this small board there's also a crystal oscillator. Beneath it, to the left, is the temperature sensor, and, to the right, the watch crystal.
The sliding switch at the bottom right allows selecting between the three possible channels.
I have no idea what the part at the bottom right does - it looks like a switch but it's actually a trimmer resistor with the top cut off. It might adjust how often the sensor sends data or the power.

Encoding scheme

I've connected the DATA pin from the TX1 board directly to the oscilloscope so I can get clean readings, without any radio receiver noise.
It seems that with each update the sensor sends 9 packets with a length of 36 bits each.
In the screenshot below I've marked the 0s and 1s to aid in decoding.

Measuring the signal yields that the encoding scheme is: 480us time unit = T. Each 0 bit is represented by T+2T. Each bit 1 is T+4T. The spacing between packets is ~8T (3900us):

Rinse and repeat for about 30 times and we start seeing the big picture. There are a lot of losses, buffer overflows and multi-threading issues (e.g. protocol 480 with 480 bits) but I can see that the significant values repeat themselves during a packet burst.

I spent a few hours into this, mostly understanding the rc-switch library and flashing the fake Arduino Nano with a fake PL2303HX serial converter. I've never seen so many blue screens in one day - until now.

As a bonus I've also decoded some RF-controlled outlets bought from Lidl 10 years ago. They were using the Quigg protocol*. Both these decoders will be opensourced once the code is cleaned up a bit.

If I were to do it again I would use the Stellaris Launchpad - it has step-by-step debugging and hands-free flashing.

*Actually, I was able to decode the RF outlets with the rc-switch library and the Stellaris, around one year ago,but somehow I could not do that with the Arduino Nano at the present time.

Wednesday, June 10, 2015

I've been using this for more than 10 years, think of it as Midnight Commander (mc) on steroids, for Windows. Screenshots of main features here: http://www.ghisler.com/screenshots/en/
It's practically the first thing I install when I need to work on a machine.

Scenarios:

copy stuff around from one drive/ftp/share to another, queuing (F2) operations along the way

view any files (F3) in ascii/unicode/hex, edit them (F4)

search in current folder (Alt+F7), much faster than using an IDE for source files

Including the plugin pack this is my go-to image viewer and basic editor. It integrates nicely with the above (F3 on an image / video file to view it).

Scenarios:

open up a picture, press T to go to the thumbnails view and batch-organize files

select an area, press Ctrl+Y to crop to that area, press Ctrl+R to resize [the long side] to a size of your choice (I choose mostly 2048 px for the blog), Ctrl+S to save, space/PgDn to go to the next picture, DEL to remove the file

This one almost does not need an introduction. If it does, I suggest you take a look at 'A case of the unexplained' video presentations and blog posts.

I use Process Monitor a lot, especially to figure out why installers fail and what secret files some programs might access. For example a firmware update utility might write the raw firmware file to some other folder than Temp. Other programs check for a registry key + a hidden file to see when the trial expires.

PowerShell, WinDBG, BootICE, Unlocker and other utilities also fall under the same category, but they are too generic/specific/slow to use in comparison.

I discovered this quite recently but it has become almost indispensable. It is like putty on steroids.

It allows managing several terminal sessions (ssh, telnet, ftp, serial!) at once, does X forwarding and saves the passwords as well. So you can have sessions for your router, Raspberry PIs, esp8266 and Arduino, all under one tabbed interface.

Also has SCP support out-of-the-box so you can browse the folders, view the files and edit them. I'm so happy whenever I don't have to use the vi retardness, especially on Solaris.

Best thing: it ports an almost complete Cygwin environment to Windows so you can run your awk/grep/cat/wc inside your DOS prompt. Close the window and it goes away.

I use this to connect from my tablet or phone to the computer(s) running in the other room. Why get up from the bed if you forgot to shutdown the computer? Or if you want to stream some PC-only web stuff to Chromecast/EZCast in the other room, without dragging your laptop.

I used to use it when Windows 8 first came out but decided to give the new Windows 10 launcher a chance. After 6 months of usage I can confidently say that Classic Shell is better. Text search works across the desktop icons as well, you can get rid of the heavy Metro sidebar and you can even disable Cortana. It's also noticeably faster in everything it does.

The first one enables different settings (for example speed) on different pointing devices while the second one allows you to map your mouse buttons to do something else.AutoHotKeyRecently started using this but there is a huge community of scripts. I like the fact that some Windows hotkeys can be disabled selectively.Dexpot
Much better than SysInternals' Desktops.

Saturday, June 6, 2015

This is a short article on a lighter note.
I got a broken keyboard (from boxes with DOA stuff) with a few keys that were not working.

I've opened the keyboard up and marked the keys that were not working, you can see a slight red marker trace in the picture below:

The key circuitry is a sandwich of three flexible plastic layers: top and bottom with conductive traces and a middle one for isolation. Only the bottom one was broken.

Using a continuity meter the breakage was traced to an area near the connector.
As a heads-up, the measured resistance for this type of traces is 5-10 ohms/cm, so for a strip/trace longer than 20 cm the meter might not beep anymore.

I had some silver paste sitting around unused, so I covered the broken traces with that.

Some shaking required....

...after shaking all the silver flakes/powder should be evenly distributed. I don't think they mention this anywhere.

I believe a bottle of that stuff is around 15E for 5ml, but should last a really long time.

There's no way to properly construct traces, I've tried using toothpicks and other small-pointed objects:

I've left it to dry for 5 minutes then proceeded to remove the large unneeded areas with a cotton ball tip and traced the outline with a needle-like tip:

After 30 mins of drying and some more cleaning the keyboard was ready for use.

Thinking that I've had the process in hand, I've tried reballing a PS3 video chip. I'm not sure it was the video chip at fault since the person who gave it to me had attempted a reflow on it, transforming the YLOD (yellow light of death) into a GLOD (green one).

Setup was pretty similar to the one in the previous post; started with a light warming (100-120C) of the complete board to provide uniform thermal expansion and remove moisture:

However the chip proved to be a beast and my hot air gun was raising the temperature too slowly to be safe.

I began looking for items that are a similar size and shape in order to make a template for the gun. This screwdriver accessory proved to be the best match.

The layout was started by wrapping some gardening wire around the magnetizer and holding it in place with some masking tape.

Not removing the tape proved to be a mistake when temperatures of 400C were involved.

The wired frame was then wrapped in food-grade aluminium foil...

...and after preheating the board I started following the lead-free solder temperature profile.

The attachment had to be moved really close to the board in order to get the temperatures to rise up fast enough: around 3 minutes are required.
Any longer than that and the chip can become toast, as well as the parts around it.

I tried to get the chip to be at 240C but it would not move. I've then removed the heat spreader (top aluminium part) exposing the bare chip and tried to remove that.

I was working in 3-5 minutes increments then slowly removing heat as to not stress the parts, then started a new cycle with 10C more.
After around 5 cycles of the above I raised the hot air temperature from 350C to 420C and see where that might go.

Still no luck, tried various tools to pry the chip off while still hot, thinking it might be attached with some strong glue.
Found out the hard way that the required temperature for removal was much higher, measured around 265C until solder balls started popping off and 280C until the chip could be removed.
Oh, I had to use a paint stripper for this, the hot air gun just could not provide sufficient thermal flow.

The result is ghastly:

The chip was permanently bent by the tools used to try to pry it, pads were ripped from the chip and pads and tracks were ripped from the motherboard.

I did not even attempt a reball at this point, there's no coming back to life for this unit.

Lessons learned:

have the proper attachment for the heat gun

ensure the gun can reach temperature in a safe time - or replace it if not

do not try to pry the chip - minor nudging should be enough to see if it's removable

The unit worked fine for ~6 months, after which it failed again with the same symptom: no video.
It sat unused for one year but then I received a PS3 with the YLOD symptom. This prompted me to order a BGA reballing set from eBay and attempt to fix them both.

The PS3 reball will be in a part 2 of this series.This is not a guide, just a journal describing the mistakes I've made during the process.

The video chip is the plagued NF-G6150 , also used in the HP DV6000. The laptop still has decent performance when paired with an SSD, for today's standards.

The area around the chip was masked with Kapton tape:

Then 'shielded' with food-grade aluminium:

I had a goose-neck-style phone cradle sitting around which provided a stable hands-free holder for the hot-air gun.

The chip was painted with a black marker (for reducing thermal reflection) and the measurement from an IR thermometer was compared to a K-type probe.

The hot air gun was left at 100C for around 15 minutes in order to heat the board uniformly to avoid a sudden thermal expansion on the working area.

After which the temperature was raised to ~350C on the gun (~250C on the chip), air speed was set to 3-4 (out of 7). This enabled a clean removal of the chip, but you can already see the non-uniformity on the surface pointing to a delamination.

The chip and motherboard were cleaned from solder - there are hundreds of how-to videos on YouTube.
The basic process: flux is added then the soldering iron is run with some fresh solder on the pads. After most of the solder has been removed, some more flux is added and the remaining solder is removed with a [copper] wire braid. The flux residue is cleaned with alcohol.

Did I mention how much I hate the Blogger editing interface? There's no way to align multiple pictures into the same area.

The chip is then covered in flux and the reballing pattern is placed over it.

A nice trick for getting the balls in (hehe) is to pour from the ball container into a larger container, over the pattern. Instead of the ~200 balls you will be using ~3k, but they can safely be reused afterwards. Learned this trick on YouTube from some random Indian guy:

The pattern and chip are then heated in order to reflow the balls and attach them to the chip

First attempt: 20% of the balls got detached from the chip and stuck on the template. Do not reuse these ones!

Second attempt: only two balls detached. They were manually placed on the pads and reflowed again, without the template in place.

The result looks promising:

Time to reflow the chip back into place. The black stuff is permanent marker that I've used to increase emissivity(?) or reduce heat reflection.

Result: no video.

I've tried two or three times to reflow the chip, I think I might've also reballed it again but there was no improvement. This one goes back to the scrap pile.

Out of my eBay 'lucky bags' I got a wireless charger for Wii remotes. I forgot about it for more than one year since I did not have a Wii at that time.
It came with two battery placeholders that also replace the battery cover of the Wii remote. I've tested the included batteries and they seemed to still hold charge.

The unit would not turn on: it's time to void the warranty on this "Kamikaze Gear Wireless Charging Dock (Wii)":

I got this pair of items from a colleague, requesting a repair. The units would not bind to each other, or rather, the RX unit (controlling the heating) would not receive anything from the TX unit.

The transmitter, pictured below, is quite a nice low-power unit. It contains the temperature sensor and provides a basic programming interface for controlling the heating - based on day of week, hour, vacation mode.

The receiver unit plugs into a free outlet, without hogging it:

I would like to see more products that take a plug space return it to the user. In this case, this plug would probably take 2 or even 3 spaces on a 45 degree German-style plug.